866 matches found
WordPress Gravity Forms plugin <= 3.0.2 - Unauthenticated Arbitrary File Upload via State/Chunk Hash Confusion vulnerability
Unauthenticated Arbitrary File Upload via State/Chunk Hash Confusion vulnerability discovered by WordFence in WordPress Plugin Gravity Forms versions = 3.0.2...
PT-2026-84219
Name of the Vulnerable Software and Affected Versions Gravity Forms versions prior to 3.0.3 Description An arbitrary file upload issue exists affecting over 1 million WordPress installations. The flaw originates from insufficient validation of the multi-file upload chunk state within the...
CVE-2026-19513: Unrestricted Upload of File with Dangerous Type
The Gravity Forms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.0.2. This is due to insufficient validation of multi-file upload chunk state in the GFAsyncUpload::upload function, where public form state URL hashes can be reused as chunk...
CVE-2026-74004
Subscriber Broken Access Control in Gravity Booster Styles & Layouts for Gravity Forms = 6.0 versions...
CVE-2026-32466
Subscriber SQL Injection in Gravity Forms Bookings premium = 2.1 versions...
EUVD-2026-60813
Subscriber Broken Access Control in Gravity Booster Styles & Layouts for Gravity Forms = 6.0 versions...
CVE-2026-74004 WordPress Gravity Booster – Styles & Layouts for Gravity Forms plugin <= 6.0 - Broken Access Control vulnerability
Subscriber Broken Access Control in Gravity Booster Styles & Layouts for Gravity Forms = 6.0 versions...
CVE-2026-74004
The WordPress plugin "Gravity Booster – Styles & Layouts for Gravity Forms" (versions ≤ 6.0) has a broken access control flaw exploitable by authenticated subscribers, allowing unauthorized access to plugin functions. CVSS 3.1 score is 5.4 (MEDIUM) with network attack vector, low privileges requi...
CVE-2026-74004 WordPress Gravity Booster – Styles & Layouts for Gravity Forms plugin <= 6.0 - Broken Access Control vulnerability
Subscriber Broken Access Control in Gravity Booster Styles & Layouts for Gravity Forms = 6.0 versions...
EUVD-2026-60902
Subscriber SQL Injection in Gravity Forms Bookings premium = 2.1 versions...
CVE-2026-32466 WordPress Gravity Forms Bookings premium plugin <= 2.1 - SQL Injection vulnerability
Subscriber SQL Injection in Gravity Forms Bookings premium = 2.1 versions...
CVE-2026-32466
Subscriber SQL Injection in Gravity Forms Bookings premium = 2.1 versions...
CVE-2026-32466 WordPress Gravity Forms Bookings premium plugin <= 2.1 - SQL Injection vulnerability
Subscriber SQL Injection in Gravity Forms Bookings premium = 2.1 versions...
CVE-2026-32466
The Gravity Forms Bookings premium WordPress plugin (versions ≤ 2.1) contains a SQL injection flaw exploitable by authenticated subscribers. CVSS 8.5 (HIGH) reflects network access with low privileges. Patchstack reports it; no in-the-wild exploitation or patch version details are provided in the...
CVE-2026-74004: Missing Authorization
Subscriber Broken Access Control in Gravity Booster – Styles & Layouts for Gravity Forms = 6.0 versions...
CVE-2026-32466: Improper Neutralization of Special Elements used in an SQL Command
Subscriber SQL Injection in Gravity Forms Bookings premium = 2.1 versions...
PT-2026-77127
Subscriber Broken Access Control in Gravity Booster Styles & Layouts for Gravity Forms = 6.0 versions...
PT-2026-77044
Subscriber SQL Injection in Gravity Forms Bookings premium = 2.1 versions...
WordPress Gravity Forms Bookings premium plugin <= 2.1 - SQL Injection vulnerability
SQL Injection vulnerability discovered by 0xVenus in WordPress Plugin Gravity Forms Bookings premium versions = 2.1...
CVE-2026-12477: Improper Neutralization of Input During Web Page Generation
The Gravity Booster – Styles & Layouts for Gravity Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 5.26 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers,...